CVE-2026-67549

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.1.16.0

Description A heap out-of-bounds write and memory corruption occur when processing a crafted 1-bit contiguous CMYK TIFF file. The issue arises because a native uint1 imagespec leads callers to allocate a bit-packed buffer, but the function read native scanline locked() invokes bit convert() with 8-bit output, writing one expanded byte per value into the smaller buffer. This behavior is triggered under the PHOTOMETRIC SEPARATED state within the src/tiff.imageio/tiffinput.cpp implementation.

Recommendations Update to version 3.1.16.0.